CyberRota Analysis
AI-GeneratedAn authorization bypass vulnerability in LXD allows authenticated users to circumvent project-level disk and volume limits, enabling them to allocate storage resources beyond the configured administrative thresholds. This can lead to resource exhaustion and potential denial-of-service conditions within affected environments. Organizations using LXD should prioritize addressing this vulnerability to safeguard their resource management and maintain operational integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.